To: 


Of: 


İCO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


ColourCoat Ltd 


77 Bohemia Road, St. Leonards-On-Sea, TN37 6RJ 


The Information Commissioner (“Commissioner”) has decided to 
issue ColourCoat Ltd (“ColourCoat”) with a monetary penalty under 
section 55A of the Data Protection Act 1998 (“DPA”). The penalty is 
being issued because of serious contraventions of Regulations 21 and 
24 of the Privacy and Electronic Communications (EC Directive) 
Regulations 2003 (“PECR”). 


This notice explains the Commissioner's decision. 


Legal framework 


ColourCoat, whose registered office is given above (Companies House 
Registration Number: 10405998), is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to Regulations 21 and 24 of PECR. 


1 The provisions of the Data Protection Act 1998 remain in force for the purposes of 
PECR notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of the 2018 Act). 
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Regulation 21 applies to the making of unsolicited calls for direct 


marketing purposes. Regulation 21 paragraph (1) of PECR provides 
that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 


Under Regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified the 
ICO that they do not wish, for the time being, to receive unsolicited 
calls for direct marketing purposes on those lines. The Telephone 
Preference Service Ltd (“TPS”) is a limited company set up to carry 
out this role. For a fee, it provides businesses who wish to carry out 
direct marketing by telephone a monthly list of numbers on two 
registers: the Telephone Preference Service register (“TPS Register”) 
for individuals’ numbers and the Corporate Telephone Preference 


Service register (“CTPS Register”) for businesses’ numbers. 


In general terms, Regulation 21 paragraph (1)(b) provides that 
companies cannot make unsolicited calls for direct marketing purposes 
to telephone numbers on the TPS Register or CTPS Register, unless the 
individual or business associated with the number has given their 


consent to receive such calls. 
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Regulation 21 paragraphs (2)-(5) provide: 


“(2) A subscriber shall not permit his line to be used in contravention of 


paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 


register for less than 28 days preceding that on which the call is 
made. 


(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under Regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 
that caller on that line, notwithstanding that the number allocated 
to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 
paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 
any time, and 


(b) where such notification is withdrawn, the caller shall not 


make such calls on that line.” 


Regulation 21 paragraph (A1) provides that companies making calls for 
direct marketing purposes must not disguise their identity. Paragraph 
(A1) states: 
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“A person shall neither use, nor instigate the use of, a public electronic 
communications service for the purposes of making calls (whether 


solicited or unsolicited) for direct marketing purposes except where 
that person— 


(a) does not prevent presentation of the identity of the calling line on 


the called line; or 
(b) presents the identity of a line on which he can be contacted.” 


Regulation 24 of PECR concerns the information which must be 
provided when, inter alia, a business makes marketing calls which 


Regulation 21 applies to. Regulation 24 provides, insofar as relevant: 


“(1) Where a public electronic communications service is used for the 
transmission of a communication for direct marketing purposes 
the person using, or instigating the use of, the service shall 
ensure that the following information is provided with that 


communication - 


(b) in relation to a communication to which regulation 21 
or 21A (telephone calls) applies, the particulars 
mentioned in paragraph (2)(a) and, if the recipient of 
the call so requests, those mentioned in paragraph 


(2)(b). 


(2) The particulars referred to in paragraph (1) are - 


(a) the name of the person; 
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(b) either the address of the person or a telephone 


number on which he can be reached free of charge.” 


Section 122(5) of the Data Protection Act 2018 (DPA 2018) defines 
direct marketing as “the communication (by whatever means) of 
advertising or marketing material which is directed to particular 
individuals”. This definition also applies for the purposes of PECR (see 
DPA 2018 Schedule 19, paragraphs 430 and 432(6)). 


Consent is defined in Article 4(11) of the General Data Protection 
Regulation 2016/679 as “any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 


“Individual” is defined in Regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in Regulation 2(1) of PECR as “a person who 
is a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


The DPA contains, at Part V, enforcement powers which are exercisable 
by the Commissioner. Under section 55A(1) of the DPA (as amended 
by the Privacy and Electronic Communications (Amendment) 
Regulations 2011 and the Privacy and Electronic Communications 
(Amendment) Regulations 2015), the Commissioner may serve a 
person with a monetary penalty notice if the Commissioner is satisfied 
that - 
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“(a) there has been a serious contravention of the requirements 


of the Privacy and Electronic Communications (EC Directive) 


Regulations 2003 by the person, and 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


15. The Data Protection (Monetary Penalties) (Maximum Penalty and 
Notices) Regulations 2010 prescribe that the amount of any penalty 


determined by the Commissioner must not exceed £500,000. 


16. The Commissioner has issued statutory guidance under section 55C(1) 
of the DPA about the issuing of monetary penalties that has been 


published on her website. 


17. PECR implemented European legislation (Directive 2002/58/EC) aimed 
at the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR were amended for the purpose 
of giving effect to Directive 2009/136/EC, which amended and 
strengthened the 2002 provisions. For the purposes of this notice, as 
EU law applied at the time of the breaches of PECR, the Commissioner 


approaches PECR so as to give effect to the Directives. 
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Background to the case 


The Companies House listing for ColourCoat records the nature of its 
business as “other building completion and finishing”. ColourCoat’s 
website (http://colourcoat.co.uk) states that it “specialise[s] in 
Hydrophobic Thermal coatings for your home” and provides roof 
coating, roof cleaning, wall coating, “EcoSolve PureAir”, spray 
insulation and flat roofing services. Mr Callum Henry Jones has been 
the sole director of the company since it was incorporated on 1 October 
2016. ColourCoat has been registered with the Information 
Commissioner's Office (“ICO”) since 11 March 2019 and with the 
Financial Conduct Authority since 17 September 2019. ColourCoat’s 
Financial Conduct Authority listing records its principal place of 
business as Room 327, Century House, 100 Menzies Road, St Leonards 
on Sea, TN38 9BB, and its trading names as: “COLOUR COAT”, “Colour 


Coat”, “ColourCoat”, “Coloured Coatings” and “EcoSolveUK”. 


The privacy policy on ColourCoat’s website contains references to a 
company called Home Logic UK Ltd, and appears to have been copied 
from Home Logic UK’s website (https://www.homelogic.co.uk/privacy). 
(Home Logic UK Ltd was fined by the Commissioner in August 2017 for 
making unsolicited direct marketing calls in breach of Regulation 21 of 
PECR.) 


ColourCoat first came to the ICO’s attention in February 2020 when 
complaints about unsolicited direct marketing calls received in January 
2020 were consolidated into a “Direct Marketing Monthly Threat 
Assessment” report compiled by the Commissioner. The eleventh most 
complained about number in the report was the mobile number 07726 


140368. Six complaints had been received in January 2020 about live 
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calls from this number by a company calling themselves “Home Advice 
Bureau”. An ICO officer called 07726 140368 and was connected to a 
pre-recorded message which stated that the call was in relation to a 


free heat loss and moisture assessment. The message gave another 


number to call - 01422 770119 - to change an existing appointment. 


On 3 March 2020, the Commissioner sent third party information 
notices to EE Ltd (“EE”) and Antheus Telecom Ltd (““Antheus”), the 
respective telecoms service providers for the numbers 07726 140368 
and 01422 770119. 


Antheus responded on 4 March 2020, identifying the subscriber of the 
01422 770119 number as ColourCoat Ltd of 77 Bohemia Road, St 
Leonards-on-Sea, TN37 6RJ; the contact name as Callum Jones; and 
the email address as info@colourcoat.co.uk. Antheus notified the 
Commissioner that, in addition, it had rented 3 further numbers to 
ColourCoat: 01424 869239, 01242 806190, and 0333 898 0107. 


Antheus also confirmed that all four numbers were still active. 


In response to the third party information notice, Antheus also 
provided call detail records (“CDRs”) for ColourCoat. These records 
showed that, between 1 and 31 January 2020, ColourCoat had made a 
total of 315,528 connected outbound calls between 1 and 31 January 
2020, using various presentation Caller Line Identities (“CLIs”) (for 
example, the mobile numbers 07726 140368 and 07596 452616). The 
Commissioner screened these records against the TPS and CTPS 
Registers. This process revealed that 135,923 of the 315,528 calls 
were made to numbers that had been registered with the TPS for more 
than 28 days and that 434 calls had been made to numbers registered 
with the CTPS for more than 28 days. 
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The Commissioner subsequently searched her complaints database and 
the TPS complaints database for complaints relating to the presentation 
CLIs used by ColourCoat for calls originating from the four numbers 
rented from Antheus. This revealed a total of 18 complaints to the TPS 


(including the 6 complaints received in January 2020) and 9 complaints 
to the ICO, received between August 2019 and January 2020. 


The Commissioner sent ColourCoat an initial investigation letter on 6 
April 2020, informing it of the ICO and TPS complaints, setting out 
ColourCoat’s obligations under PECR and the ICO’s enforcement 
powers, and asking ColourCoat to provide answers to a number of 
questions by 27 April 2020. 


A substantive response was received from ColourCoat’s solicitor, B 


PE on | June 2020. This email set out 


the following: 


a. ColourCoat had made a total of 1,527,816 calls between 1 
August 2019 and 31 March 2020, of which 200,180 calls 


connected. 


b. ColourCoat provided 8 different numbers it had used as 


presentation CLIs for the purpose of making these calls. 


c. ColourCoat used the “Homes Advice Bureau” and “Eco Solve 


UK” trading names during calls. 


d. Data was purchased from a number of third parties, including 


es =: 
BS . ColourCoat accepted that it did not carry out 


sufficient due diligence on the data and it only became fully 
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aware of its obligations in early 2020. Once ColourCoat 


became aware of its obligations, it started in February 2020 a 


process of TPS screening, using a third party company, 


. At the time of the letter, ColourCoat did not have any written 


policies or procedures regarding lawful contact with 
customers, but were in the process of developing these. 
Though ColourCoat stated that it operated an internal “Do Not 
Call List”. 


. Attached to the email was a copy of the call script used by 


ColourCoat. The script encouraged ColourCoat employees to 
state that they were “following up on the recent government 
incentive which topped up loft insulation or cavity wall 
insulation” and that “the insulation which was originally 
commissioned by the government has been causing a number 
of issues that now need to be assessed”. The script also 
encouraged ColourCoat employees to state they were calling 


on behalf of “Homes Advice Bureau”. 


On 28 April 2020, the Commissioner issued Antheus with a further 
third party information notice, requesting CDRs for August 2019 to 
December 2019 and February 2020 to March 2020. Antheus responded 
on 3 June 2020. The CDRs provided listed a total, excluding the 
315,528 calls made during January 2020, of 653,745 connected calls 
made by ColourCoat between 1 August 2019 and 19 March 2020. 


The CDRs for these calls were screened against the TPS and CPS. This 
process revealed that 315,143 calls were made to numbers that had 
been registered with the TPS for more than 28 days and that 1,311 
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calls had been made to numbers registered with the CTPS for more 
than 28 days. 


Further searches of the TPS and ICO complaints databases, using the 
presentation CLIs provided by both ColourCoat and Antheus Telecom, 
revealed that there had been a total of 24 complaints to the TPS and 
10 complaints to the ICO between August 2019 and March 2020. 


The complaints recorded that ColourCoat used various different 
presentation CLIs and various false company names, including “Homes 
Advice Bureau”, “EcoSolve UK” and on one occasion, “Citizens’ Advice 
Bureau”. Some complainants reported that they had received repeated 
calls from different ColourCoat numbers despite opt-out requests. The 


following are examples of the comments made by the complainants: 


e “They say they have an inspector in the area to do free insulation 
inspections. It is the 2nd call I recieved [sic] from them this week 
and I get a call every day of every week and they said they have 
never contacted us before. I said I want them to delete my 


number and I will be contacting the ICO” 


e “Claimed to be an independent government body organising 
surveys of homes previously fitted with cavity wall insulation due 
to issues reported in the local area. Became quite rude / 


aggressive when challenges.” 


e “Asked me about an address I lived at more than 9 years ago 
(same phone no!) and about a new government insulation 
scheme. I said shouldn’t be calling me as on TPS - he said he 
wasn’t to know. I said he should be screening and asked who he 


was Calling from - he said Citizens advice and I said you're 
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having a laugh I'll speak to the manager then. Apparently he was 


in the toilet and as I said that’s fine TIl just report to ICO and he 
then hung up.” 


“To inform me that I had arranged an appointment about loss 
and moisture assessment (which I hadn't !) When I phoned the 
number back another recorded message directed me to another 
number which was 0142277019 - which I did not do as I realised 
that it was a scam and if I did I might be charged a considerable 


amount of money for the call.” 


“I have had several similar calls and this is obviously a scam. 


these people know my name address and I feel a threatened.” 


“Insulation. Something to do with a government backed scheme. 
Asked for their website and they gave the one given above - but 


this does not exist.” 


“someone called Michelle - offering free heating and insulation 
survey. They have been asked not to call before, but do not take 
any notice. When this number was dialled back, a recorded 
message says to contact 0144 806190, but when this number is 
dialled it is not a correct number. Original called was very 


n" 


abusive and would not take 'we are not interested' as an answer 


“Rude woman called Wendy offering heat loss and moisture 
assessment. She def shouldn't be in any kind of customer service 
Also use the number 01424 806190 on their ansaphone [sic] but 


it is identified as an incorrect number when you call. Total scam” 
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EE responded to the 3 March 2020 third party information notice 
regarding the 07726 140368 number on 26 June 2020. EE stated that 
the number was associated with an ASDA prepay mobile account in the 
name Mr John Smith of [ies The 


account was activated on 2 April 2019 and the first payment was made 
on 10 December 2019. 


A Google Maps search conducted by an ICO officer revealed that E 
C- only 1.9 miles from ColourCoat's registered office at 77 


Bohemia Road. 


EE also provided CDRs for all outgoing calls from this number between 
1 and 31 January 2020. These revealed a total of 2,121 calls. There 
was a high number of short duration calls, sometimes several calls per 
minute, all during the working day. No calls were made during 
evenings or weekends. All the calls were to mobile numbers. Only 101 
of the numbers called were registered with the TPS. The Commissioner 
therefore considered that number 07726 140368 was primarily being 
used by ColourCoat as a presentation CLI when making calls from 


numbers rented from Antheus. 


The Commissioner emailed ColourCoat’s solicitor, BE, to inform 
him of EE’s response, and to ask him to explain the relationship 
between Mr John Smith and ColourCoat and why ColourCoat were 
using this number as a presentation CLI. MJ responded on 24 July 
2020, explaining that the number was purchased by ColourCoat, the 
name John Smith had been given to avoid the purchaser receiving 
spam and unwanted communications, the other mobile numbers used 
by ColourCoat were also purchased by ColourCoat, and that ColourCoat 
had used these mobile numbers as presentation CLIs following the 


receipt of informal guidance that this was permitted. 
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35. [BRR called the ICO on 3 August 2020 stating that, though 
marketing was not a core part of ColourCoat’s business, it admitted it 
had made mistakes. The Case Officer told JJ the investigation 
was complete. (J offered to send the Commissioner a document 


outlining ColourCoat’s mitigation by 10 August 2020. No such 
document has been received to date. 


36. In conclusion, the Commissioner is satisfied that: 


a. 969,273 connected calls were all made for the purposes of 
direct marketing as defined by section 122(5) DPA 2018. 


b. Of these calls, 452,811 were made to numbers which had 
been registered on the TPS or CTPS Registers for more than 
28 days. 


c. ColourCoat made repeat calls to subscribers who had informed 


ColourCoat that they did not wish to receive such calls. 


d. ColourCoat used telephone numbers on which the recipients of 


the calls could not contact ColourCoat. 


e. ColourCoat used various false company names (including 
“Homes Advice Bureau”, “EcoSolve UK” and “Citizens Advice”) 
and/or did not identify itself. 


37. The Commissioner has made the above findings of fact on the 


balance of probabilities. 
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The Commissioner has considered whether these facts constitute a 


contravention of Regulations 21 and 24 of PECR by ColourCoat and, if 


so, whether the conditions of section 55A DPA are satisfied. 
The contraventions 


The Commissioner finds that ColourCoat contravened Regulations 21 
and 24 of PECR. 


The Commissioner finds that the contraventions were as follows: 


Between 1 August 2019 to 31 March 2020, ColourCoat used public 
telecommunications services for the purposes of making total of 
969,273 connected unsolicited calls for direct marketing purposes. 
These calls resulted in 24 complaints being made to the TPS and 10 


complaints to the Commissioner. 


ColourCoat made repeat calls to subscribers who had informed 
ColourCoat that they did not wish to receive such calls, in breach of 
Regulation 21(1)(a) of PECR. 


In breach of Regulation 21(1)(b) of PECR, 452,811 of the calls in 
question were to subscribers where the number allocated to the 
subscriber of the called line was a number listed on the TPS or CTPS 
Registers maintained in accordance with Regulation 26 of PECR. The 
Commissioner is satisfied for the purposes of Regulation 21 that these 
452,811 unsolicited direct marketing calls were made to subscribers 
who had registered with the TPS or CTPS at least 28 days prior to 
receiving the calls, and they had not given their prior consent to 


ColourCoat to receive calls. 
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In relation to the 969,273 total connected calls, ColourCoat used 

numbers on which the recipients of the calls could not contact 

ColourCoat. This was done using various presentation Caller Line 

Identities (“CLIs”). ColourCoat also used various false company 

names (including “Homes Advice Bureau”, “EcoSolve UK” and “Citizens 

Advice”) and/or did not identify itself. ColourCoat was therefore in 


breach of: 


a. Regulation 21(A1) of PECR, not to prevent presentation of the 
identity of the calling line on the called line, and to present 


the identity of a line on which it could be contacted; and 


b. Regulation 24(1)(b) of PECR, to provide the recipient of the 
calls with its name and either its address or a telephone 


number on which it could be reached free of charge. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there have been multiple breaches 
of Regulations 21 and 24 of PECR by ColourCoat arising from its 
activities over an eight month period and this led to a substantial 
number of unsolicited direct marketing calls being made. Between 1 
August 2019 and 31 March 2020 there were 969,273 connected calls, 
equating to an average of 121,159 calls per month or 29,372 calls per 
week. This includes 452,811 connected calls to numbers on the TPS or 
CTPS Registers, equating to an average of 56,601 calls per month or 
13,722 calls per week. 
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Furthermore: 


a. A significant proportion of ColourCoat’s marketing calls were 
to numbers that had been registered on the TPS and CTPS 


Registers for more than 28 days. 


b. ColourCoat made repeat calls to subscribers after they had 
informed ColourCoat that they no longer wished to receive 


such calls. 


c. ColourCoat used presentation CLIs to prevent call recipients 
from contacting it. It also failed to identify itself on the calls 


and/or provided false company names. 


Many of the calls in question were simultaneously in breach of various 


PECR requirements. 


ColourCoat acted in a manner which complainants described as “rude”, 
“aggressive” and “abusive”, and which made one complainant feel 
“threatened”. Multiple complainants reported that the calls made them 


|“ 


feel “annoyed and/or anxious”. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate or negligent. 


Deliberate contravention 
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52. The Commissioner is satisfied that ColourCoat deliberately contravened 


Regulations 21(A1) and 24 of PECR for the following reasons: 


a. ColourCoat used 15 different presentation CLIs, rather than 
the CLIs which had been assigned to it by Antheus, in order to 


prevent call recipients from contacting it; 


b. ColourCoat set up a mobile phone account with a false name 
in order to make it harder to identify ColourCoat’s use of that 


number as a presentation CLI; and 


c. ColourCoat did not identify itself on the calls and/or provided 
false company names, including “Homes Advice Bureau”, 
which is not registered with Companies House or the Financial 
Conduct Authority. 


53. The Commissioner considers that ColourCoat deliberately contravened 


Regulation 21(1) of PECR for the following reasons: 


a. In relation to Regulation 21(1)(a) and (b), as particularised 
above, ColourCoat deliberately sought to disguise its identity 


to avoid detection. 


b. In relation to Regulation 21(1)(a), ColourCoat was aware from 
previous marketing calls that subscribers no longer wished to 


receive such calls. 


c. In relation to Regulation 21(1)(b), ColourCoat received 
notification by individual call recipients (who had complained 
to the ICO or TPS) that their numbers were registered with 
the TPS or CTPS and should not be called for direct marketing 
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purposes. These notifications would have made ColourCoat 


aware of the fact that contraventions were occurring. 


Negligent contravention 


Further and in the alternative, the Commissioner has gone on to 
consider whether the contraventions identified above was negligent. 


This consideration comprises two elements: 


First, the Commissioner has considered whether ColourCoat knew or 
ought reasonably to have known that there was a risk that these 
contraventions would occur. She is satisfied that this condition is met 


for the following reasons: 


a. Mr Jones was appointed to ColourCoat in October 2016 and 
therefore had sufficient time and opportunity to become aware 
of his full fiduciary duties, including his obligations of ensuring 


compliance with PECR. 


b. Though ColourCoat told the ICO that marketing was not a core 
part of its business, the fact that ColourCoat engaged ina 
high volume of marketing calls (969,273 connected calls over 
the period in question) indicates that direct marketing was an 
important part of its operations. As such, ColourCoat should 
reasonably have sought to familiarise itself with the relevant 


statutory regime. 


c. Advice concerning the requirements imposed by PECR on 
businesses which make direct marketing calls is widely 
available. For example, the ICO website is easily accessible 
and contains “Direct Marketing Guidance”, which sets 


requirements imposed by PECR on businesses. This guidance 
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explains the circumstances under which organisations are able 

to carry out marketing over the phone, by text, by email, by 

post or by fax. Specifically, it states that live calls must not be 

made to subscribers who have told an organisation that they 

do not want to receive calls; or to any number registered with 

the TPS, unless the subscriber has specifically consented to 

receive calls. In case organisations remain unclear on their 

obligations, the ICO operates a telephone helpline. ICO 

communications about enforcement action where businesses 

do not comply with PECR are also readily available. 

ColourCoat was registered with the ICO as a data controller 

and should have been aware of the ICO website and telephone 


helpline. 


. ColourCoat ignored, or failed to act upon, notification by 


individual call recipients (who had complained to the ICO or 
TPS) that their numbers were listed on the TPS or CTPS 
Registers and should not be called for direct marketing 
purposes. This reaction should have served as a warning to 


ColourCoat that it was not complying with the law. 


It is therefore reasonable to suppose that ColourCoat should have been 


aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether 
ColourCoat failed to take reasonable steps to prevent the 


contravention. Again, she is satisfied that this condition is met. 


The Commissioner’s “Direct Marketing Guidance” makes clear that 
organisations acquiring and using marketing lists from a third party 


must undertake rigorous checks to satisfy themselves that the personal 
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data was obtained fairly and lawfully, that personal details would be 
passed along for direct marketing to the specifically named 
organisation in the case of live calls, and that the organisation buying 
the data has the necessary consent. It is not acceptable to rely on 
assurances given by third party suppliers without undertaking proper 
due diligence. ColourCoat accept that it did not carry out sufficient due 
diligence on the data purchased from third parties, had no written 
policies with regards to PECR, and that it only became fully aware of 


their obligations in early 2020. 


Reasonable steps in these circumstances may also have included a 


combination of the following: 


a. Asking the third-party data providers for evidence that 
subscribers had specifically consented to receiving direct 


marketing calls from ColourCoat. 


b. Screening the third party data against the TPS and CTPS 


Registers, as ColourCoat began to do in February via 


EE before using that data for marketing 


purposes. 


c. Ensuring that ColourCoat’s internal “Do Not Call List” was 


accurate and effectively applied. 


d. Using the CLIs provided by Antheus Telecom and the company 


name registered with Companies House and the FCA. 


60. The Commissioner is therefore satisfied that 
condition (b) from section 55A(1) DPA is met. 
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The Commissioner's decision to issue a monetar enalt 


The Commissioner has taken into account the following aggravating 


features of this case: 


ColourCoat sought to evade identification by using presentation CLIs to 
prevent call recipients from contacting it, and by failing to identify itself 
on the calls and/or providing false company names including “Homes 
Advice Bureau”. ColourCoat also purported to be calling on behalf of the 


Citizens’ Advice Bureau and the Government. 


ColourCoat made repeat calls to subscribers who had informed 


ColourCoat that they did not wish to receive such calls. 


ColourCoat acted in a manner which complainants described as “rude”, 
“aggressive” and “abusive”, and which made one complainant feel 
“threatened”. Multiple complainants reported that the calls made them 


|“ 


feel “annoyed and/or anxious”. 


ColourCoat ignored, or failed to act upon, obvious indications that it was 


acting in breach of PECR. In particular: 


o ColourCoat ignored, or failed to act upon, notifications by 
individual call recipients that their numbers were registered with 
the TPS or CTPS and should not be called for direct marketing 


purposes. 


o Mr Jones, as ColourCoat’s sole director, ought to have known, as 
part of his fiduciary duties, of ColourCoat’s obligations arising 
under PECR prior to ColourCoat beginning to trade, or at the very 


least upon the receipt of complaints by call recipients and the TPS. 
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The Commissioner has taken into account the following mitigating 


features of this case: 


ColourCoat began TPS screening in February 2020. However, this 
factor carries significantly reduced weight, as its contravention of 
Regulation 21(1) of PECR continued until 31 March 2020. 


ColourCoat operates an internal “Do Not Call List”. However, in the 
absence of further evidence from ColourCoat relating to when this list 
was introduced and how it has been applied, the Commissioner has 


given this factor very limited weight. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A(1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 


made by ColourCoat in this matter. 


The Commissioner is not persuaded to alter her position as expressed 


in the Notice of Intent. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 
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The Commissioner has endeavoured to consider the likely impact of a 
monetary penalty on ColourCoat. She has decided on the information 
that is available to her, and in the particular circumstances of this case, 


that a monetary penalty remains an appropriate and proportionate 


response. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an 
opportunity to reinforce the need for businesses to ensure that they 
meet the strict criteria to engage in such activities and are only 


telephoning consumers who want to receive these calls. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £130,000 (One hundred and thirty 
thousand pounds) is reasonable and proportionate given the 
particular facts of the case and the underlying objective in imposing the 


penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 17 July 2021 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government’s general bank account at 
the Bank of England. 
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If the Commissioner receives full payment of the monetary penalty by 
16 July 2021, the Commissioner will reduce the monetary penalty by 
20% to £104,000 (one hundred and four thousand pounds). 

However, you should be aware that the early payment discount is not 


available if you decide to exercise your right to appeal. 


There is a right to appeal to the First-tier Tribunal (Information Rights) 


against: 


a) the imposition of the monetary penalty and/or; 


b) the amount of the penalty specified in the monetary penalty notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified in the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 
penalty has not been paid; 

e all relevant appeals against the monetary penalty notice and any 
variation of it have either been decided or withdrawn; and 

e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 


Scotland, the monetary penalty can be enforced in the same manner as 
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an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom of Scotland. 


Dated the 16th day of June 2021 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice or variation notice has been served a right 
of appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 
against the notice. 


2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in accordance 
with the law; or 


b) tothe extent that the notice involved an exercise of discretion by the 
Commissioner, that she ought to have exercised her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as could 
have been made by the Commissioner. In any other case the Tribunal will 
dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 
at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 


Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the Tribunal 
within 28 days of the date of the notice. 
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b) If your notice of appeal is late the Tribunal will not admit it unless the 
Tribunal has extended the time for complying with this rule. 


4. The notice of appeal should state: - 


a) your name and address/name and address of your representative (if 
any); 


b) an address where documents may be sent or delivered to you; 
c) the name and address of the Information Commissioner; 

d) details of the decision to which the proceedings relate; 

e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the monetary 
penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the notice of 
appeal must include a request for an extension of time and the reason why 
the notice of appeal was not provided in time. 


5. Before deciding whether or not to appeal you may wish to consult your 
solicitor or another adviser. At the hearing of an appeal a party may conduct 
his case himself or may be represented by any person whom he may 
appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier Tribunal 
(Information Rights) are contained in section 55B(5) of, and Schedule 6 to, 
the Data Protection Act 1998, and Tribunal Procedure (First-tier Tribunal) 
(General Regulatory Chamber) Rules 2009 (Statutory Instrument 2009 No. 
1976 (L.20)). 
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